Skip to content

Commit

Permalink
update(bpf): read upper_layer from kernel space
Browse files Browse the repository at this point in the history
Signed-off-by: Hendrik Brueckner <[email protected]>
  • Loading branch information
hbrueckner committed Dec 21, 2022
1 parent b470f9b commit adcdd65
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion driver/bpf/fillers.h
Original file line number Diff line number Diff line change
Expand Up @@ -2256,7 +2256,7 @@ static __always_inline bool get_exe_upper_layer(struct inode *inode)

// Pointer arithmetics due to unexported ovl_inode struct
// warning: this works if and only if the dentry pointer is placed right after the inode struct
bpf_probe_read(&upper_dentry, sizeof(upper_dentry), vfs_inode + sizeof(struct inode));
bpf_probe_read_kernel(&upper_dentry, sizeof(upper_dentry), vfs_inode + sizeof(struct inode));

if(upper_dentry)
{
Expand Down

0 comments on commit adcdd65

Please sign in to comment.